Commit ddf2846f authored by Edward Adam Davis's avatar Edward Adam Davis Committed by Dave Kleikamp
Browse files

jfs: add sanity check for agwidth in dbMount 



The width in dmapctl of the AG is zero, it trigger a divide error when
calculating the control page level in dbAllocAG.

To avoid this issue, add a check for agwidth in dbAllocAG.

Reported-and-tested-by: default avatar <syzbot+7c808908291a569281a9@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=7c808908291a569281a9


Signed-off-by: default avatarEdward Adam Davis <eadavis@qq.com>
Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
parent b61e69bb

fs/jfs/jfs_dmap.c

+4 −0
Original line number Diff line number Diff line
@@ -204,6 +204,10 @@ int dbMount(struct inode *ipbmap) 
	bmp->db_aglevel = le32_to_cpu(dbmp_le->dn_aglevel);

	bmp->db_agheight = le32_to_cpu(dbmp_le->dn_agheight);

	bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);

	if (!bmp->db_agwidth) {

		err = -EINVAL;

		goto err_release_metapage;

	}

	bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart);

	bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size);

	if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG ||